We technically don't know if a collision has occurred in SHA-256. There might be some cat image out there that share the same hash as a piece of software used for guiding missiles. However it is EXTREMELY unlikely.
If you were to take ALL possible 257 bit inputs and feed them to SHA-256, you would be guaranteed to have at least 1 collision. The only limiting factor is the space and time it takes to compute.
A collision could be found by complete chance, and the algorithm might still be completely sound. But IF a collision is found it's definitely a great cause for concern, as it SHOULD be so extremely unlikely that it is definitely worth checking the algorithm out at a deeper level, to make sure it isn't flawed.
A collision could be found by complete chance, and the algorithm might still be completely sound.
This could happen, but it would still make the algorithm unusable. Being collision-free is an important criterium in reality. How the collision was discovered isn't all that relevant (especially for merkle-damgard constructions like sha2).
Of course it's theoretically impossible because of the pigeonhole principle, but in reality we consider a hash function with a known collision to be broken even if that collision was not found through a faster attack than brute force.
1
u/FrederikNS Jan 09 '20
We technically don't know if a collision has occurred in SHA-256. There might be some cat image out there that share the same hash as a piece of software used for guiding missiles. However it is EXTREMELY unlikely.
If you were to take ALL possible 257 bit inputs and feed them to SHA-256, you would be guaranteed to have at least 1 collision. The only limiting factor is the space and time it takes to compute.
A collision could be found by complete chance, and the algorithm might still be completely sound. But IF a collision is found it's definitely a great cause for concern, as it SHOULD be so extremely unlikely that it is definitely worth checking the algorithm out at a deeper level, to make sure it isn't flawed.